From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jacob Friis Larsen Subject: Port is open but I am unable to connect Date: Tue, 07 Sep 2004 21:27:26 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <413E0B9E.8010708@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org When I add -s 1.2.3.4 I am unable to connect to my server. nmap shows that the correct ports are open. Any ideas? iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 22 -m state --state NEW This is my script: Thanks, Jacob From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sascha Reissner Subject: Re: Port is open but I am unable to connect Date: Tue, 07 Sep 2004 21:35:04 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <413E0D68.6020208@toxicnet.de> References: <413E0B9E.8010708@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413E0B9E.8010708@list.idg.dk> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Jacob Friis Larsen Cc: netfilter@lists.netfilter.org just to make sure.. you are certain, that you want -s 1.2.3.4? this means source ip is 1.2.3.4 (so the ip you connect from, not the ip you connect _to_) Jacob Friis Larsen wrote: > When I add -s 1.2.3.4 I am unable to connect to my server. > nmap shows that the correct ports are open. > Any ideas? > > iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 22 -m state > --state NEW > > This is my script: > > > Thanks, > Jacob > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Opperisano Subject: Re: Port is open but I am unable to connect Date: Tue, 07 Sep 2004 16:19:58 -0400 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <1094588398.1890.54.camel@wolfpack.ljm.dom> References: <413E0B9E.8010708@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413E0B9E.8010708@list.idg.dk> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Tue, 2004-09-07 at 15:27, Jacob Friis Larsen wrote: > When I add -s 1.2.3.4 I am unable to connect to my server. > nmap shows that the correct ports are open. > Any ideas? > > iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 22 -m state > --state NEW i would content that while you believe your source IP is 1.2.3.4 in this scenario--it; in fact, is not. try: iptables -A INPUT -j LOG --log-prefix "FW DROP INPUT: " and see what the logs have to say about it. -j -- Jason Opperisano From mboxrd@z Thu Jan 1 00:00:00 1970 From: Aleksandar Milivojevic Subject: Re: Port is open but I am unable to connect Date: Tue, 07 Sep 2004 15:59:15 -0500 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <413E2123.6050908@pbl.ca> References: <413E0B9E.8010708@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413E0B9E.8010708@list.idg.dk> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Jacob Friis Larsen wrote: > When I add -s 1.2.3.4 I am unable to connect to my server. > nmap shows that the correct ports are open. > Any ideas? > > iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 22 -m state > --state NEW > > This is my script: [snip] > # STATE RELATED for router > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > > # Localhost > iptables -A INPUT -i lo -j ACCEPT > iptables -A OUTPUT -o lo -j ACCEPT > > # Open ports on router for server/services > iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 20 -m state > --state NEW > iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 21 -m state > --state NEW > iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 22 -m state > --state NEW > iptables -A INPUT -j ACCEPT -p tcp --dport 25 -m state --state NEW > iptables -A INPUT -j ACCEPT -p tcp --dport 80 -m state --state NEW > iptables -A INPUT -j ACCEPT -p tcp --dport 143 -m state --state NEW > iptables -A INPUT -j ACCEPT -p tcp --dport 993 -m state --state NEW All your rules (apart from lo interface) are for INPUT chain. No rules for OUTPUT chain (so all return packets get dropped there). You are missing "-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT" at the begginging of your rules (just after similar INPUT line you already have). BTW, what's the point of accepting connections to port 20? It's FTP port used for active data transfers, and connections are made *from* it, not *to* it. Since you have (will have) "just accept anything related I don't care" rules, just add "modprobe ip_nat_ftp" line somewhere into your script, and FTP will work (you don't need that port 20 line). -- Aleksandar Milivojevic Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jacob Friis Larsen Subject: Re: Port is open but I am unable to connect Date: Wed, 08 Sep 2004 08:34:52 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <413EA80C.9090200@list.idg.dk> References: <413E0B9E.8010708@list.idg.dk> <413E0D68.6020208@toxicnet.de> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413E0D68.6020208@toxicnet.de> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Sascha Reissner Cc: netfilter@lists.netfilter.org > just to make sure.. you are certain, that you want -s 1.2.3.4? No 1.2.3.4 is just for the example :) I don't dare to show my real ip, in case of a bad iptables script. Thanks, Jacob From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jacob Friis Larsen Subject: Re: Port is open but I am unable to connect Date: Wed, 08 Sep 2004 08:38:33 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <413EA8E9.3090700@list.idg.dk> References: <413E0B9E.8010708@list.idg.dk> <1094588398.1890.54.camel@wolfpack.ljm.dom> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1094588398.1890.54.camel@wolfpack.ljm.dom> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Jason Opperisano Cc: netfilter@lists.netfilter.org > i would content that while you believe your source IP is 1.2.3.4 in this > scenario--it; in fact, is not. I know. 1.2.3.4 is just for the example :) > try: > > iptables -A INPUT -j LOG --log-prefix "FW DROP INPUT: " > > and see what the logs have to say about it. This will log all incoming packets? Thanks, Jacob From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jacob Friis Larsen Subject: Re: Port is open but I am unable to connect Date: Wed, 08 Sep 2004 08:47:18 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <413EAAF6.5030804@list.idg.dk> References: <413E0B9E.8010708@list.idg.dk> <413E2123.6050908@pbl.ca> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413E2123.6050908@pbl.ca> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Aleksandar Milivojevic Cc: netfilter@lists.netfilter.org > All your rules (apart from lo interface) are for INPUT chain. No rules > for OUTPUT chain (so all return packets get dropped there). You are > missing "-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT" at > the begining of your rules (just after similar INPUT line you already > have). Sounds logic. I changed it in the script below, and will try it out later when I can get to the server. > BTW, what's the point of accepting connections to port 20? It's FTP > port used for active data transfers, and connections are made *from* > it, not *to* it. Since you have (will have) "just accept anything > related I don't care" rules, just add "modprobe ip_nat_ftp" line > somewhere into your script, and FTP will work (you don't need that > port 20 line). OK, I changed that too. Thanks a lot! Jacob >> This is my script: > > [snip] > modprobe ip_nat_ftp >> # STATE RELATED for router >> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT >> >> # Localhost >> iptables -A INPUT -i lo -j ACCEPT >> iptables -A OUTPUT -o lo -j ACCEPT >> >> # Open ports on router for server/services #iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 20 -m state >> --state NEW >> iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 21 -m state >> --state NEW >> iptables -A INPUT -s 1.2.3.4 -j ACCEPT -p tcp --dport 22 -m state >> --state NEW >> iptables -A INPUT -j ACCEPT -p tcp --dport 25 -m state --state NEW >> iptables -A INPUT -j ACCEPT -p tcp --dport 80 -m state --state NEW >> iptables -A INPUT -j ACCEPT -p tcp --dport 143 -m state --state NEW >> iptables -A INPUT -j ACCEPT -p tcp --dport 993 -m state --state NEW From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Opperisano Subject: Re: Port is open but I am unable to connect Date: Wed, 08 Sep 2004 07:35:04 -0400 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <1094643303.1903.3.camel@wolfpack.ljm.dom> References: <413E0B9E.8010708@list.idg.dk> <1094588398.1890.54.camel@wolfpack.ljm.dom> <413EA8E9.3090700@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413EA8E9.3090700@list.idg.dk> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Wed, 2004-09-08 at 02:38, Jacob Friis Larsen wrote: > > i would content that while you believe your source IP is 1.2.3.4 in this > > scenario--it; in fact, is not. > > I know. > 1.2.3.4 is just for the example :) > > > try: > > > > iptables -A INPUT -j LOG --log-prefix "FW DROP INPUT: " > > > > and see what the logs have to say about it. > > This will log all incoming packets? setting the above as you last rule, in combination with setting the POLICY of the INPUT chain to DROP, will log all packets dropped by the INPUT chain. similarly: iptables -A OUTPUT -j LOG --log-prefix "FW DROP OUTPUT: " will log all packets dropped by the OUTPUT chain; which in your case, should show you what Aleksandar already pointed out--you don't allow ESTABLISHED packets out through the OUTPUT chain. -j -- Jason Opperisano From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jacob Friis Larsen Subject: Re: Port is open but I am unable to connect Date: Thu, 09 Sep 2004 12:17:40 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <41402DC4.3030901@list.idg.dk> References: <413E0B9E.8010708@list.idg.dk> <413E2123.6050908@pbl.ca> <413EAAF6.5030804@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <413EAAF6.5030804@list.idg.dk> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Cc: Aleksandar Milivojevic With the changes I still can't connect. I also use bonding if that's important. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Opperisano Subject: Re: Port is open but I am unable to connect Date: Thu, 09 Sep 2004 08:20:47 -0400 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <1094732447.1897.44.camel@wolfpack.ljm.dom> References: <413E0B9E.8010708@list.idg.dk> <413E2123.6050908@pbl.ca> <413EAAF6.5030804@list.idg.dk> <41402DC4.3030901@list.idg.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <41402DC4.3030901@list.idg.dk> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Thu, 2004-09-09 at 06:17, Jacob Friis Larsen wrote: > With the changes I still can't connect. I also use bonding if that's > important. dunno about bonding...might be important. > just to clarify a point--the services your trying to connect to *are* running locally on the machine running netfilter, correct? the only reason i ask, is because the comment "Open ports on router for server/services" leads me to believe that "router" and "server" are two different machines. if "server" is behind "router" you should be using FORWARD filter rules, not INPUT... anyways...at this point--i'd recommend: iptables -A INPUT -j LOG --log-prefix "FW DROP IN: " iptables -A OUTPUT -j LOG --log-prefix "FW DROP OUT: " iptables -A FORWARD -j LOG --log-prefix "FW DROP FWD: " and then "tail -f /var/log/messages" and try to connect. the logs will tell you why the firewall is dropping the traffic. -j -- Jason Opperisano